tegwick
39f39b5ff6
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 7m15s
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
257 lines
17 KiB
Markdown
257 lines
17 KiB
Markdown
---
|
|
id: CSOC-WP-0015
|
|
type: workplan
|
|
title: "Communication runtime, inbox operations and flow acceptance"
|
|
domain: communication
|
|
repo: coulomb-social
|
|
status: active
|
|
owner: codex
|
|
topic_slug: coulomb-social
|
|
created: "2026-10-08"
|
|
updated: "2026-10-31"
|
|
origin: residual
|
|
origin_ref: CSOC-WP-0010
|
|
state_hub_workstream_id: "38208f72-c285-56fa-be44-de9b59a4e031"
|
|
---
|
|
|
|
Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.
|
|
|
|
## Current execution map — 2026-10-31
|
|
|
|
T01 caller policy, T03 independent ledger recovery and the narrowed T04
|
|
implementation/native rehearsal/application release are complete. T02 owns the
|
|
platform sender and return-mail operation. Platform-root with Bernd as human
|
|
operator is now explicitly accepted; see decision 9392ef52 below. Sender admission,
|
|
inbox access and return-message correlation remain unverified. Suppression
|
|
handling and retention also remain open. Backup-specific
|
|
Gmail receipt does not close those gates. T05 exposes productive flow verdicts
|
|
and T06 the remaining native reset-authority owner return.
|
|
|
|
The [four-workplan assessment](../docs/release/goal-progress-audit-2026-10-31.md)
|
|
records the scope split and effort estimate. Task counts are not effort percentages.
|
|
Historical notes retain the evidence trail; this map and the task blocks govern
|
|
current status. No original acceptance requirement has been dropped.
|
|
|
|
## T01 — Admit and activate explicit transactional caller policies
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e87ea643-7bee-5427-b4f5-b32f20dc2f29"
|
|
```
|
|
|
|
Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.
|
|
|
|
2026-10-27: EMAIL-WP-0008 completed scoped caller custody and coordinated activation
|
|
on October 9. Current receiver policy/projection and user-engine tenant/client
|
|
bindings are present, both deployments Ready. Owner no-send denial/replay receipts
|
|
and the expanded 103-test isolated gate verify the admitted integration. Productive
|
|
flow verdicts remain T04. See docs/release/acceptance-audit-2026-10-27.md.
|
|
|
|
## T02 — Establish platform sender and monitored reply/bounce ownership
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "0604cb15-72c7-5d15-bb42-0335d4ec80df"
|
|
```
|
|
|
|
Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.
|
|
|
|
2026-10-31 concrete follow-through: T02 advanced from todo to progress. User
|
|
selected platform-root with Bernd Worsch as human operator for platform-mail
|
|
replies/bounces, including registration/invitation; decision9392ef52-3bfe-42fd-b6d5-ec0730656775
|
|
is resolved. Native generation74/source hashes confirm the receiver still uses
|
|
forgejo@coulomb.social and has no admitted suppression caller. Four authoritative
|
|
nameservers agree on MX/SPF/DMARC and three documented DKIM CNAMEs. This is DNS
|
|
publication evidence, not delivered-message authentication.
|
|
|
|
Prepared three scoped SMTP projection resources and exact sender/environment
|
|
patches; all five native server dry-runs pass with unchanged image/PVC/caller
|
|
policy and unrelated spec. New consumer custody now has the prepared owner
|
|
controller below; live admission and supervised sender rollout remain pending,
|
|
so execution_ready is false. Offline actual-owner-source proof
|
|
shows accepted Message-ID/bounce correlation and scanner deduplication, but no
|
|
scanner-to-transactional suppression bridge; the existing operator API works only
|
|
under synthetic admission and affects a recipient across callers/tenants. No
|
|
production send, mailbox scan, credential read or runtime change occurred.
|
|
Concrete packet and remaining sequence:
|
|
docs/release/platform-mail-sender-review-2026-10-31.md. Owner identity need not be
|
|
asked again. Next: fixed owner SMTP admission and supervised sender rollout;
|
|
bounded operator return handling plus retention and productive access proof.
|
|
|
|
Owner follow-through is now a live dependency: railiance-platform RPF-WP-0068
|
|
(c042789b-4d7f-5c55-8d49-39dd16500f41), CCR-2026-0056. Its T01 fixed reader/helper
|
|
and T02 supervised foundation/controller preparation are complete; T03 waits for
|
|
platform/consumer review and founder admission, and T04 owns the native return.
|
|
The complete controller passed41 SMTP tests and three native server dry-runs.
|
|
The target Secret is absent by metadata-only query. It verifies native SA binding,
|
|
guarded read admission, workload login/denials/revocation and projection Ready,
|
|
with a private durable phase journal and no sender change. Live execution has not
|
|
occurred; this is not yet verified custody or delivered-message acceptance.
|
|
See docs/release/platform-mail-custody-preparation-2026-10-31.md for the owner
|
|
review packet and exact closure conditions. This dependency is tracked as work,
|
|
not left only in this task's progress narrative.
|
|
|
|
## T03 — Complete independent ledger recovery and copy custody
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "286e60bf-76a1-5a18-bd2c-edd9d1400c41"
|
|
```
|
|
|
|
EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.
|
|
|
|
2026-10-27: EMAIL-WP-0007 completed independent provider escrow, separately bound
|
|
recovery reader, nonexpiring image/tools/receipt kit, six-table offline recovery,
|
|
mirrored rolling archives and monitored schedules on October 10. Fresh checks show
|
|
both timers active and today's backup/freshness successful, with verified mirror.
|
|
The app gate now binds real encryption/recovery and scoped quota continuity tests;
|
|
103 owner cases pass with zero skips. Historical private copies remain retained
|
|
pending explicit owner disposition, with no inferred expiry/deletion. Production
|
|
restore still requires fencing and post-capture reconciliation. See the audit.
|
|
|
|
## T04 — Implement, rehearse and release owner-spanning browser journeys
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T04
|
|
status: done
|
|
priority: high
|
|
decision_id: "75b94bb6-4709-495f-91fe-43e53e2867ed"
|
|
state_hub_task_id: "7c718d86-8f0d-5cb2-a765-b0c07116005c"
|
|
needs_human: false
|
|
```
|
|
|
|
**Current scope after the October 31 tracking audit:** The owner-source and native isolated browser gates plus the exact revision 19 application release are complete. Productive UC-010/011 verdicts, current Case B and any remaining reset review continue in T05; the native reset-authority owner return continues in T06. Existing personal reset acceptance remains preserved. This split does not promote unaccepted journeys to established.
|
|
|
|
Earlier dated notes below are retained as history, not the current task state.
|
|
|
|
Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.
|
|
|
|
2026-10-11: the checkout has a loopback issuer, directory and mailbox double. The browser node is bound on UC-009/010/011 and still `established: false`. It covers reset-to-local-mailbox, sign-in, callback replay, expired and reused handles, tenant and client refusal, registration verify/cancel, and caller/suppression invitation counts. No SMTP, production account, or live issuer is contacted. Real user-engine/email-connect admission, DNS and productive per-flow verdicts remain open. UC-012 stays deferred. Gate for this slice: `make check` 200 passed.
|
|
|
|
2026-10-30: added an explicit real-owner-source browser gate for UC-010/011.
|
|
Private snapshots run the actual user-engine portal, registration/outbox HTTP
|
|
adapters and email-connect scoped receiver/SQLite ledger, with synthetic session,
|
|
authorization, directory, activity sink and mail provider. Actual forms cover
|
|
verify/cancel/expiry/replay, fresh-handle cross-caller denial, tenant/client/token
|
|
denials, cross-tenant admin refusal, invitation/resend, duplicate delivery and
|
|
suppression. Python only permits fixture ports; browser routes/API redirects are
|
|
bounded to fixture origins. No production configuration, account, SMTP provider,
|
|
mailbox scan or original note body is used. Exact node is linked in the candidate
|
|
registry and the invocation is in docs/usecases/platform-communication.md.
|
|
Proof: docs/release/owner-communication-browser-2026-10-30.json. This completes
|
|
the owner-source UC-010/011 browser integration slice, not native issuer/directory/
|
|
app-login coverage or productive per-flow verdicts. T04 remains progress; T02
|
|
sender/inbound/bounce ownership and UC-012 nomination remain separate gates.
|
|
|
|
2026-10-30 UC-009 callback follow-through: signed-token reproduction found that
|
|
optional UserInfo could replace verified identity/tenant/assurance claims and a
|
|
token-response userinfo object could bypass the ID-token requirement. Corrected
|
|
the app assembler to require the verified token, exact UserInfo subject equality
|
|
and profile-only enrichment.13 real RSA/JWKS callback cases cover refusal,
|
|
authority preservation, step-up denial and optional-UserInfo fallback;20 focused
|
|
identity cases pass. Candidate registry links added without promoting UC-009.
|
|
Review: docs/release/oidc-userinfo-binding-review-2026-10-30.md. This source is
|
|
not in the sealed17d0eb6storage image; a subsequent reviewed release is required.
|
|
Full native reset/directory/inbox/app browser coverage and productive verdicts
|
|
remain open. No production login, issuer change, mail or deployment performed.
|
|
Full `make check`:396 passed, zero skips; all newly linked UC-009 fast node IDs
|
|
are present in its JUnit report. Bounded proof and source hashes are retained in
|
|
docs/release/oidc-userinfo-binding-review-2026-10-30.json.
|
|
|
|
2026-10-30 native recovery prerequisite: added an isolated pinned Authelia4.39.28/
|
|
LLDAP0.6.2 rehearsal with no ports, host mounts or external routes. The strict
|
|
read-only bind from NetKingdom's source permits first factor and reset-link
|
|
verification but refuses password update (HTTP200/KO); the synthetic password-
|
|
manager bind succeeds and actual old/new directory authentication switches.
|
|
Both refuse consumed-link replay, unverified reset, interactive service sign-in
|
|
and directory group creation. All containers removed; generated fixture values
|
|
remain private. Review/evidence: docs/release/native-password-reset-review-2026-10-30.md
|
|
and native-password-reset-2026-10-30.{json,sources.txt}. Retain the supported narrow
|
|
reset-authority review on the existing NK-WP-0054-T05 owner boundary; no live
|
|
grant, installed-role conclusion or provider task duplication. Full browser/
|
|
expiry/mail-sink/KeyCape/app coverage and productive release remain open here.
|
|
Final source-bound native proof includes verified cleanup and three CLI refusal
|
|
cases. Full `make check` rerun:396 passed, zero skips, mandatory browsers included.
|
|
|
|
2026-10-31 native browser follow-through: the exact explicit node
|
|
scripts/native_recovery/test_journey.py::test_native_reset_directory_smtp_issuer_and_app
|
|
passes with zero skips. Real Authelia UI/LLDAP/SMTP-to-local-sink exercise read-only
|
|
refusal, successful password replacement, expired and replayed native links.
|
|
Real KeyCape PKCE/JWT plus the current app source and actual user-engine HTTP
|
|
claims service establish the app session; old-password and callback replay,
|
|
unknown-client, wrong-redirect and explicit directory/client tenant-conflict
|
|
controls refuse. One owner user/Member and unusable local password are verified.
|
|
Kernel network-none/loopback, scoped browser requests and all-container cleanup
|
|
are verified. Owner storage/PDP are fixtures; no productive grant, MFA or TLS
|
|
trust-store acceptance. Review/proof: docs/release/native-recovery-browser-review-2026-10-31.md
|
|
and native-recovery-browser-2026-10-31.{json,sources.txt}. Candidate registry binds
|
|
the node without promotion. Existing NK-WP-0054-T05 reset-authority return,
|
|
productive UC-010/011 verdicts and deployment/runtime acceptance remain open.
|
|
Full `make check`:396 passed, zero skips. Four separate synthetic JUnit-envelope
|
|
checks refuse wrong/skipped/failed/extra nodes without publishing a proof; the
|
|
real native gate itself passes its exact one node with zero skips.
|
|
|
|
2026-10-31 packaged OIDC fix: candidate source 23ffe2c is published at immutable
|
|
digest 522bcd7f and independently verified against the registry and all 80 packaged
|
|
source files. All 25 OIDC/export focused tests pass inside that image, with actual
|
|
packaged application imports, no source overlay, network none and synthetic
|
|
identity peers. Python and all 25 runtime distribution versions match the live
|
|
image. Source full gate 441 passes; recovered-store candidate/previous-image view
|
|
checks also pass. Review: docs/release/identity-export-candidate-review-2026-10-31.md.
|
|
The fix remains undeployed pending its separate exact current-target release
|
|
packet and supervised execution. Native owner/productive verdicts, sender and
|
|
inbox ownership remain open; this image publication grants no such acceptance.
|
|
|
|
2026-10-31 supervised release preparation: separate owner image-only controller
|
|
and 16-member capsule9f1daf6c pass 19 release safety tests, lint/compile and native
|
|
read-only preflight against revision18 and the post-correction dataset. It requires
|
|
the existing migration/global constraint, preserves migration history and full
|
|
business/content hashes, captures/readbacks a fresh paired primary before Helm,
|
|
and verifies postflight plus any image/helper rollback. Default live values and
|
|
installed helper remain unchanged. The completed storage launcher is not reused.
|
|
Owner execution is RAPPS-WP-0015-T05; open decision75b94bb6. Concrete founder steps
|
|
and evidence: docs/release/identity-export-release-review-2026-10-31.md. Execution,
|
|
independent current-point recovery/export and productive flow verdicts remain open.
|
|
|
|
2026-10-31 founder image-release return: proposal9f1daf6c completed at07:15:24Z,
|
|
Helm revision19/image522bcd7f. Independent complete-spec/Ready/identity checks,
|
|
all80packaged source hashes, unchanged92business rows/86files/migration history,
|
|
40owner renders/40outsider denials, public endpoints and refreshed helperdcc8dd2a
|
|
all pass. Live owner values/product pins are reconciled. Fresh07:13 primary point
|
|
is mirrored, independently retrieved and restored (13tables/114rows/86files);
|
|
packaged client export verifies85files without source mutation. Full make check
|
|
441passes, zero skips. Release decision75b94bb6 is resolved only for that exact
|
|
execution; RAPPS-WP-0015-T05 is complete. Productive flow and service/offboarding
|
|
acceptance remain open. Return: docs/release/identity-export-release-return-2026-10-31.md.
|
|
|
|
## T05 — Obtain productive registration and invitation flow verdicts
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T05
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "120ec9a8-6340-576f-8a3c-b8139c0dc25a"
|
|
```
|
|
|
|
Acceptance scope split from T04: current Case B, UC-010 registration and UC-011 invitation/resend/cancel/expiry behavior need private owner-spanning productive review and explicit verdicts. Preserve existing UC-009 personal-reset acceptance and UC-008 manual distribution; review only remaining reset differences. Keep each gap as live work and do not promote candidate journeys from isolated tests alone. UC-012 remains deferred pending an explicitly selected template/caller, not an implied requirement to add arbitrary notifications. Review sources: `docs/usecases/platform-communication.md` and `docs/identity/smoke.md`.
|
|
|
|
## T06 — Verify the native reset-authority owner return
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T06
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "e17a6d09-1fdd-5fa1-a36d-763802e37f7f"
|
|
```
|
|
|
|
Remaining owner admission from T04 is canonical NK-WP-0054-T05. Isolated native Authelia/LLDAP reset and full browser integration are proven, including read-only-bind refusal and successful scoped password replacement. Obtain and assess the owner native authority/runtime return; preserve MFA/TLS/directory boundaries and link acceptance here. Do not create a duplicate provisioning lane or infer a live grant from the synthetic proof. Evidence: `docs/release/native-recovery-browser-review-2026-10-31.md` and `native-password-reset-review-2026-10-30.md`.
|
|
|
|
## Completion
|
|
|
|
Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.
|